diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c

index 486c102..dc12a85 100644

--- a/bin/nsupdate/nsupdate.c

+++ b/bin/nsupdate/nsupdate.c

@@ -1566,16 +1566,20 @@ evaluate_realm(char *cmdline) {

 #ifdef GSSAPI

 	char *word;

 	char buf[1024];

+	int n;

-	word = nsu_strsep(&cmdline, " \t\r\n");

-	if (word == NULL || *word == 0) {

-		if (realm != NULL)

-			isc_mem_free(mctx, realm);

+	if (realm != NULL) {

+		isc_mem_free(mctx, realm);

 		realm = NULL;

-		return (STATUS_MORE);

 	}

-	snprintf(buf, sizeof(buf), "@%s", word);

+	word = nsu_strsep(&cmdline, " \t\r\n");

+	if (word == NULL || *word == 0)

+		return (STATUS_MORE);

+

+	n = snprintf(buf, sizeof(buf), "@%s", word);

+	if (n < 0 || (size_t)n >= sizeof(buf))

+		fatal("realm is too long");

 	realm = isc_mem_strdup(mctx, buf);

 	if (realm == NULL)

 		fatal("out of memory");